@getvitops/create 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @getvitops/create
 
+## 0.6.0
+
+### Minor Changes
+
+- Scaffolded `static` and `emdash` projects now ship neutral placeholder wireframe images under
+  `src/assets/placeholder/` (square, portrait, landscape; SVG + PNG) for layout work before real
+  imagery exists. Delete the directory once real assets land.
+
 ## 0.5.0
 
 ### Minor Changes
@@ -227,15 +235,15 @@
   which `@getvitops/astro` re-exports wholesale. So from `astro.config.mjs`:
 
   ```js
-  import { generateIconInclude } from '@getvitops/astro';
-  import icon from 'astro-icon';
+  import { generateIconInclude } from "@getvitops/astro";
+  import icon from "astro-icon";
 
   integrations: [
     icon({
       include: generateIconInclude({
-        ui: 'fa7-solid',
-        brand: 'simple-icons',
-        semantic: ['menu', 'close', 'search', 'github'],
+        ui: "fa7-solid",
+        brand: "simple-icons",
+        semantic: ["menu", "close", "search", "github"],
       }),
     }),
   ];

package/README.md

@@ -73,6 +73,13 @@ provisions the D1/R2 resources on first deploy).
 Template dependencies must use concrete npm ranges (no `workspace:*` /
 `catalog:` — the scaffolded project lives outside this monorepo).
 
+`assets/` (this package root, unpublished) is the source of truth for
+placeholder imagery shared across templates — `vp create` copies only the
+one directory a template names, so there's no step that could copy a
+sibling `assets/` for you. Mirror any new file into each template's
+`src/assets/placeholder/` by hand; `templates.test.ts` asserts every mirror
+stays byte-identical to the source.
+
 ## Changelog
 
 This package's history: [`CHANGELOG.md`](./CHANGELOG.md) (shipped in the npm tarball, so it

package/package.json

@@ -1,8 +1,15 @@
 {
   "name": "@getvitops/create",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Project templates for the Vitops design system — scaffold wired-up sites with `vp create @getvitops`.",
+  "homepage": "https://docs.vitops.ca",
+  "bugs": "https://github.com/getvitops/design-system/issues",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/getvitops/design-system.git",
+    "directory": "packages/create"
+  },
   "files": [
     "templates",
     "CHANGELOG.md"
@@ -12,10 +19,18 @@
     "access": "public"
   },
   "devDependencies": {
-    "vitest": "^4.1.9"
+    "vitest": "4.1.9"
+  },
+  "engines": {
+    "node": ">=24"
   },
   "createConfig": {
     "templates": [
+      {
+        "name": "static",
+        "description": "Static Astro website on Cloudflare Workers static assets with the Vitops design system pre-wired",
+        "template": "./templates/static"
+      },
       {
         "name": "emdash",
         "description": "EmDash CMS website on Cloudflare Workers (D1 + R2) with the Vitops design system pre-wired",

package/templates/emdash/.env

@@ -0,0 +1 @@
+CLOUDFLARE_API_TOKEN=your_cloudflare_api_token

package/templates/emdash/.github/workflows/ci.yml

@@ -0,0 +1,12 @@
+# Runs on every PR: typecheck + design-lint + build. deploy-dev.yml /
+# deploy-prod.yml call the same reusable `site-ci.yml` themselves before they
+# deploy, so this is what gives a PR the identical signal before it's even
+# merged to `dev` — a broken build never reaches the dev worker.
+name: CI
+
+on:
+  pull_request:
+
+jobs:
+  ci:
+    uses: getvitops/design-system/.github/workflows/site-ci.yml@v1

package/templates/emdash/.github/workflows/deploy-dev.yml

@@ -3,6 +3,11 @@
 # `dev` is the integration branch — every push here refreshes the review site.
 # Promote to production with the "Promote dev → main" workflow (promote.yml).
 #
+# Deploys via the vitops toolchain's reusable EmDash deploy workflow — see
+# https://github.com/getvitops/design-system/blob/main/.github/workflows/site-deploy-emdash.yml
+# for what it does. Pinned to @v1 so a fix there reaches this repo without a
+# manual re-paste; bump the tag deliberately if you want to pick up a change.
+#
 # Required repo secrets:
 #   CLOUDFLARE_API_TOKEN   — token with Workers + D1 + R2 edit on this account
 #   CLOUDFLARE_ACCOUNT_ID  — the Cloudflare account id
@@ -14,28 +19,21 @@ on:
   push:
     branches: [dev]
 
-permissions:
-  contents: read
-
 concurrency:
   group: deploy-dev
   cancel-in-progress: true
 
 jobs:
   deploy:
-    runs-on: ubuntu-latest
-    environment: dev
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: Build + deploy dev worker
-        run: pnpm run deploy:dev
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          DEV_D1_ID: ${{ secrets.DEV_D1_ID }}
+    uses: getvitops/design-system/.github/workflows/site-deploy-emdash.yml@v1
+    with:
+      environment: dev
+      is-dev: true
+      # Set this to your dev worker's URL (or dev.<domain>) once known, so a
+      # bad migration fails the deploy instead of surfacing to the first
+      # visitor — see the reusable workflow's docblock.
+      health-check-url: ''
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      DEV_D1_ID: ${{ secrets.DEV_D1_ID }}

package/templates/emdash/.github/workflows/deploy-prod.yml

@@ -1,36 +1,32 @@
 # Deploys `main` to production.
 # `main` should be branch-protected — it then only advances via the Promote
-# workflow (promote.yml), so a push here always represents promoted code.
+# workflow (promote.yml), so a push here always represents promoted code. The
+# `production` GitHub Environment (set up by `scripts/init-github.mjs`) has
+# required reviewers restricted to admins, so this PAUSES for approval before
+# deploying.
 #
-# Required repo secrets:
-#   CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID
+# Deploys via the vitops toolchain's reusable EmDash deploy workflow — see
+# https://github.com/getvitops/design-system/blob/main/.github/workflows/site-deploy-emdash.yml
+#
+# Required repo secrets: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID
 name: Deploy prod
 
 on:
   push:
     branches: [main]
 
-permissions:
-  contents: read
-
 concurrency:
   group: deploy-prod
   cancel-in-progress: false
 
 jobs:
   deploy:
-    runs-on: ubuntu-latest
-    environment: production
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: Build + deploy prod worker
-        run: pnpm run deploy
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+    uses: getvitops/design-system/.github/workflows/site-deploy-emdash.yml@v1
+    with:
+      environment: production
+      is-dev: false
+      # Set this to your production URL once known.
+      health-check-url: ''
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

package/templates/emdash/.github/workflows/promote.yml

@@ -2,48 +2,20 @@
 # Opens a PR from dev into the protected `main` branch and enables auto-merge;
 # the merge triggers Deploy prod.
 #
-# Branch protection on `main` means the merge only completes when its rules are
-# satisfied. Choose ONE:
-#   (a) let a human approve the PR (required reviews) — safest, full audit trail;
-#   (b) set repo secret PROMOTE_TOKEN to a PAT / GitHub App token allowed to
-#       bypass protection, for hands-off promotion.
-# The default GITHUB_TOKEN cannot approve its own PR, so with required reviews
-# the PR waits for a human — which is usually what you want for a prod promotion.
+# Deploys via the vitops toolchain's reusable promote workflow — see
+# https://github.com/getvitops/design-system/blob/main/.github/workflows/site-promote.yml
+# for the branch-protection / PROMOTE_TOKEN options.
 #
-# Schema/content promotion is deliberately NOT here — the content model lives in
-# the EmDash database, not git. Apply schema changes to prod via the admin or
-# the site's MCP server, additive changes before the code deploy that uses
+# Schema/content promotion is deliberately NOT here — the content model lives
+# in the EmDash database, not git. Apply schema changes to prod via the admin
+# or the site's MCP server, additive changes before the code deploy that uses
 # them, removals after the code that stops using them.
 name: Promote dev → main
 
 on:
   workflow_dispatch:
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   promote:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Open promotion PR and enable auto-merge
-        env:
-          GH_TOKEN: ${{ secrets.PROMOTE_TOKEN || github.token }}
-        run: |
-          set -euo pipefail
-          if gh pr view dev --base main --json number >/dev/null 2>&1; then
-            echo "Promotion PR already open; ensuring auto-merge is enabled."
-          else
-            # printf, not a multi-line string: an unindented continuation line
-            # would end this YAML block and break the whole workflow file.
-            gh pr create --base main --head dev \
-              --title "Promote dev → main" \
-              --body "$(printf '%s\n\n%s' \
-                "Automated code promotion from \`dev\`. Merging deploys to production." \
-                "Remember: schema/content changes live in the EmDash database, not git — promote them separately if this release changes the content model.")"
-          fi
-          gh pr merge dev --auto --merge
+    uses: getvitops/design-system/.github/workflows/site-promote.yml@v1
+    secrets: inherit

package/templates/emdash/.mcp.json

@@ -7,6 +7,10 @@
     "emdash-docs": {
       "type": "http",
       "url": "https://docs.emdashcms.com/mcp"
+    },
+    "semrush": {
+      "type": "http",
+      "url": "https://mcp.semrush.com/v1/mcp"
     }
   }
 }

package/templates/emdash/.nvmrc

@@ -0,0 +1 @@
+24

package/templates/emdash/AGENTS.md

@@ -7,6 +7,10 @@ styled by the Vitops design system.
   (colors, type, spacing, patterns, animations). Never edit
   `src/styles/tailwind.css` — it is generated from the JSON by the
   `vitops()` integration on every dev/build and is gitignored.
+- `src/assets/placeholder/` holds neutral wireframe stand-ins (square,
+  portrait, landscape; SVG + PNG) for layout work before real imagery
+  exists. Delete the directory once real assets land — it's separate from
+  `src/assets/logo.svg`, the actual brand asset.
 - Content lives in the EmDash database, not in the repo. Query it with
   `getEmDashCollection` / `getEmDashEntry` from `emdash`; render Portable Text
   with `<PortableText />` from `emdash/ui` (the Vitops blocks from

package/templates/emdash/README.md

@@ -16,6 +16,10 @@ Scaffolded from `vp create @getvitops:emdash`.
 - **`@getvitops/emdash`** — design-system Portable Text blocks in the editor
   slash menu: image compare, copy snippet, banner, disclosure, carousel
 
+`src/assets/placeholder/` ships neutral wireframe images for layout work
+before real imagery exists — delete once real assets land (separate from
+`src/assets/logo.svg`, the brand asset).
+
 ## Local development
 
 ```bash

package/templates/emdash/design-system.json

@@ -54,7 +54,7 @@
       "p": "1rem",
       "fs": "1rem"
     },
-    "radii": { "pill": "999px", "circle": "50%" },
+    "radii": { "circle": "50%" },
     "groups": {
       "control": {
         "ds": "var(--ds-default)",

package/templates/emdash/scripts/init-github.mjs

@@ -1,15 +1,29 @@
 // One-time GitHub bootstrap: creates a GitHub repo named after this project
-// (package.json name), pushes `main` + `dev`, and makes `dev` the default
-// branch — the shape the deploy workflows expect (deploy-dev on push to dev,
-// deploy-prod on push to main, promote.yml between them).
+// (package.json name), pushes `main` + `dev`, makes `dev` the default branch,
+// and provisions the branch-protection + environment policy the deploy
+// workflows assume (deploy-dev on push to dev, deploy-prod on push to main,
+// promote.yml between them):
+//
+//   - `main` requires a PR + the `ci` status check — it only advances via
+//     promote.yml, never a direct push.
+//   - the `production` GitHub Environment requires review from an admin
+//     collaborator before deploy-prod.yml is allowed to run — this is the
+//     "promoting to prod needs admin sign-off" gate.
+//   - `dev` is left UNPROTECTED on purpose — that's what lets an agent (or
+//     anyone with push access) commit and merge there directly for
+//     integration; only the promotion to `main` is gated.
 //
 //   pnpm run init:github             # private repo (default)
 //   pnpm run init:github -- --public
 //   pnpm run init:github -- --dry-run
 //
-// Idempotent: safe to re-run — existing git repo, commits, dev branch, and
-// origin remote are all left alone. Requires the GitHub CLI (`gh`), logged in
-// (`gh auth login`).
+// Idempotent: safe to re-run — existing git repo, commits, dev branch, origin
+// remote, branch protection and environments are all left alone or updated
+// in place. Requires the GitHub CLI (`gh`), logged in (`gh auth login`).
+//
+// NOTE: branch protection and environment required-reviewers are GitHub
+// Pro/Team features on a PRIVATE repo. Each `gh api` call below prints the
+// manual equivalent and continues rather than aborting when it 403s.
 
 import { execSync, spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
@@ -48,6 +62,26 @@ function run(cmd) {
   }
 }
 
+/**
+ * Like `run`, but for `gh api` calls that provision an org/plan-gated
+ * feature (branch protection, environment reviewers). A 403 there means the
+ * repo's plan doesn't support it — not that the bootstrap failed — so this
+ * prints the manual equivalent and keeps going instead of exiting.
+ */
+function runPolicy(cmd, manualHint) {
+  if (dryRun) {
+    console.log(`[dry-run] ${cmd}`);
+    return;
+  }
+  console.log(`$ ${cmd}`);
+  const result = spawnSync(cmd, { shell: true, encoding: 'utf8' });
+  if (result.status === 0) return;
+  console.warn(
+    `\nWARNING: \`${cmd}\` failed (likely needs GitHub Pro/Team on a private repo).\n` +
+      `Set it up manually instead:\n  ${manualHint}\n`,
+  );
+}
+
 // --- Preflight: gh installed and authenticated -------------------------------
 if (check(['gh', '--version']).status !== 0) {
   console.error('ERROR: the GitHub CLI (`gh`) is required. Install it from https://cli.github.com');
@@ -64,7 +98,7 @@ if (quiet('git rev-parse --is-inside-work-tree') === null) {
 }
 if (quiet('git rev-parse HEAD') === null) {
   run('git add -A');
-  run('git commit -m "Initial commit (scaffolded from @getvitops/create emdash template)"');
+  run('git commit -m "Initial commit (scaffolded from @getvitops/create)"');
 }
 
 // The workflows key off `main`; normalize whatever the initial branch is.
@@ -86,9 +120,58 @@ run('git push -u origin main dev');
 run('gh repo edit --default-branch dev');
 run('git checkout dev');
 
+// --- Policy: protect main, gate production behind admin review --------------
+const nwo = quiet('gh repo view --json nameWithOwner -q .nameWithOwner');
+if (nwo) {
+  runPolicy(
+    `gh api -X PUT repos/${nwo}/branches/main/protection --input - <<'JSON'
+{
+  "required_status_checks": { "strict": true, "contexts": ["ci"] },
+  "enforce_admins": false,
+  "required_pull_request_reviews": { "required_approving_review_count": 1 },
+  "restrictions": null,
+  "allow_force_pushes": false,
+  "allow_deletions": false
+}
+JSON`,
+    `Settings → Branches → protect 'main' (require a PR, 1 approval, the 'ci' ` +
+      `status check, no force-push/deletion).`,
+  );
+
+  const admins = quiet(
+    `gh api repos/${nwo}/collaborators?permission=admin -q '[.[].login]' 2>/dev/null`,
+  );
+  const reviewers = admins
+    ? JSON.parse(admins).map((login) => ({ type: 'User', id_or_login: login }))
+    : [];
+
+  runPolicy(
+    `gh api -X PUT repos/${nwo}/environments/production --input - <<'JSON'
+{
+  "reviewers": ${JSON.stringify(reviewers)},
+  "deployment_branch_policy": { "protected_branches": true, "custom_branch_policies": false }
+}
+JSON`,
+    `Settings → Environments → 'production' → require reviewers = your admins, ` +
+      `restrict deployment branches to 'main'. This is the prod-needs-admin-approval gate.`,
+  );
+
+  // `dev` gets an environment too (for the deploy-dev workflow's `environment:
+  // dev` reference), but deliberately no reviewers and no branch restriction —
+  // that's what keeps it open for direct pushes/merges.
+  runPolicy(
+    `gh api -X PUT repos/${nwo}/environments/dev --input - <<'JSON'
+{ "reviewers": [] }
+JSON`,
+    `Settings → Environments → create 'dev' with no required reviewers.`,
+  );
+} else {
+  console.warn('WARNING: could not resolve the repo name-with-owner; skipping policy setup.');
+}
+
 // --- What's left (manual, needs your Cloudflare account) ---------------------
 console.log(`
-Repo ready: main (production) + dev (integration, default branch).
+Repo ready: main (protected, production) + dev (integration, default branch).
 NOTE: the first workflow runs will fail until the secrets below exist.
 
 Next steps:
@@ -97,6 +180,7 @@ Next steps:
   2. Secrets:        gh secret set CLOUDFLARE_API_TOKEN
                      gh secret set CLOUDFLARE_ACCOUNT_ID
                      gh secret set DEV_D1_ID
-  3. Protect main:   Settings → Branches → protect 'main' (require the
-                     promotion PR + review), so prod only ships via promote.yml.
+  3. Verify policy:  Settings → Branches (main protected?) and
+                     Settings → Environments → production (reviewers set?) —
+                     printed above if this ran on a plan that supports them.
 `);

package/templates/emdash/src/assets/placeholder/wireframe-400x400.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="400" height="400" viewBox="0 0 400 400"><rect width="100%" height="100%" fill="#DDDDDD"/><path fill="#999999" d="M87.3 204.72h11.66v-12.54q0-1.77.24-3.92zm17.36 0h4.82v3.79q0 .53-.35.91-.34.39-.98.39h-3.49v9.35h-5.7v-9.35H82.79q-.66 0-1.16-.42-.51-.41-.64-1.02l-.69-3.31 18.16-24.25h6.2zm35.59-4.72q0 5.01-1.08 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.47 3.59-2.59 1.18-5.58 1.18-3 0-5.55-1.18-2.56-1.17-4.44-3.59-1.88-2.41-2.94-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.94-6.09t4.44-3.59q2.55-1.18 5.55-1.18 2.99 0 5.58 1.18 2.58 1.18 4.47 3.59 1.9 2.41 2.97 6.09 1.08 3.69 1.08 8.72m-6.76 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1 1.62-1.6 4.35t-.6 6.89.6 6.89 1.6 4.35q1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89m37.5 0q0 5.01-1.08 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.47 3.59-2.59 1.18-5.58 1.18-3 0-5.55-1.18-2.56-1.17-4.44-3.59-1.88-2.41-2.94-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.94-6.09t4.44-3.59q2.55-1.18 5.55-1.18 2.99 0 5.58 1.18 2.58 1.18 4.47 3.59 1.9 2.41 2.97 6.09 1.08 3.69 1.08 8.72m-6.76 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1 1.62-1.6 4.35t-.6 6.89.6 6.89 1.6 4.35q1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89m48.84 10.39-3.47 3.42-8.99-8.99-9.06 9.04-3.47-3.42 9.06-9.09-8.64-8.64 3.45-3.44 8.64 8.64 8.58-8.59 3.5 3.45-8.61 8.61zm22.95-5.67h11.66v-12.54q0-1.77.24-3.92zm17.35 0h4.83v3.79q0 .53-.35.91-.34.39-.98.39h-3.5v9.35h-5.69v-9.35h-16.17q-.66 0-1.16-.42-.51-.41-.64-1.02l-.69-3.31 18.15-24.25h6.2zm35.59-4.72q0 5.01-1.07 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.48 3.59-2.58 1.18-5.57 1.18-3 0-5.56-1.18-2.55-1.17-4.43-3.59-1.89-2.41-2.95-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.95-6.09 1.88-2.41 4.43-3.59 2.56-1.18 5.56-1.18 2.99 0 5.57 1.18 2.59 1.18 4.48 3.59 1.9 2.41 2.97 6.09 1.07 3.69 1.07 8.72m-6.75 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1.01 1.62-1.6 4.35-.6 2.73-.6 6.89t.6 6.89q.59 2.73 1.6 4.35 1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89m37.49 0q0 5.01-1.07 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.48 3.59-2.58 1.18-5.57 1.18-3 0-5.56-1.18-2.55-1.17-4.43-3.59-1.89-2.41-2.95-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.95-6.09 1.88-2.41 4.43-3.59 2.56-1.18 5.56-1.18 2.99 0 5.57 1.18 2.59 1.18 4.48 3.59 1.9 2.41 2.97 6.09 1.07 3.69 1.07 8.72m-6.75 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1.01 1.62-1.6 4.35-.6 2.73-.6 6.89t.6 6.89q.59 2.73 1.6 4.35 1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89"/></svg>

package/templates/emdash/src/assets/placeholder/wireframe-400x600.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="400" height="600" viewBox="0 0 400 600"><rect width="100%" height="100%" fill="#DDDDDD"/><path fill="#999999" d="M87.3 304.72h11.66v-12.54q0-1.77.24-3.92zm17.36 0h4.82v3.79q0 .53-.35.91-.34.39-.98.39h-3.49v9.35h-5.7v-9.35H82.79q-.66 0-1.16-.42-.51-.41-.64-1.02l-.69-3.31 18.16-24.25h6.2zm35.59-4.72q0 5.01-1.08 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.47 3.59-2.59 1.18-5.58 1.18-3 0-5.55-1.18-2.56-1.17-4.44-3.59-1.88-2.41-2.94-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.94-6.09t4.44-3.59q2.55-1.18 5.55-1.18 2.99 0 5.58 1.18 2.58 1.18 4.47 3.59 1.9 2.41 2.97 6.09 1.08 3.69 1.08 8.72m-6.76 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1 1.62-1.6 4.35t-.6 6.89.6 6.89 1.6 4.35q1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89m37.5 0q0 5.01-1.08 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.47 3.59-2.59 1.18-5.58 1.18-3 0-5.55-1.18-2.56-1.17-4.44-3.59-1.88-2.41-2.94-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.94-6.09t4.44-3.59q2.55-1.18 5.55-1.18 2.99 0 5.58 1.18 2.58 1.18 4.47 3.59 1.9 2.41 2.97 6.09 1.08 3.69 1.08 8.72m-6.76 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1 1.62-1.6 4.35t-.6 6.89.6 6.89 1.6 4.35q1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89m48.84 10.39-3.47 3.42-8.99-8.99-9.06 9.04-3.47-3.42 9.06-9.09-8.64-8.64 3.45-3.44 8.64 8.64 8.58-8.59 3.5 3.45-8.61 8.61zm40.94-29.55-11.37 13.91-1.32 1.65q1.11-.56 2.4-.86 1.28-.31 2.76-.31 2.18 0 4.23.72 2.05.71 3.62 2.16 1.56 1.44 2.52 3.59.95 2.14.95 5 0 2.68-.98 5.03-.98 2.34-2.76 4.09-1.77 1.75-4.28 2.76-2.5 1-5.52 1-3.08 0-5.51-.98-2.44-.98-4.16-2.74-1.73-1.76-2.64-4.24-.92-2.48-.92-5.5 0-2.7 1.1-5.55t3.41-5.92l9.14-12.27q.48-.64 1.39-1.09.92-.45 2.11-.45zm-9.88 33.39q1.56 0 2.87-.53t2.25-1.48q.94-.96 1.47-2.24.53-1.29.53-2.8 0-1.64-.5-2.95t-1.43-2.23q-.93-.91-2.23-1.39-1.29-.48-2.86-.48-1.56 0-2.83.53-1.28.53-2.18 1.47t-1.4 2.23-.5 2.77q0 1.59.43 2.9.44 1.31 1.3 2.24t2.13 1.44q1.28.52 2.95.52M288.96 300q0 5.01-1.07 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.48 3.59-2.58 1.18-5.57 1.18-3 0-5.56-1.18-2.55-1.17-4.43-3.59-1.89-2.41-2.95-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.95-6.09 1.88-2.41 4.43-3.59 2.56-1.18 5.56-1.18 2.99 0 5.57 1.18 2.59 1.18 4.48 3.59 1.9 2.41 2.97 6.09 1.07 3.69 1.07 8.72m-6.75 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1.01 1.62-1.6 4.35-.6 2.73-.6 6.89t.6 6.89q.59 2.73 1.6 4.35 1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89m37.49 0q0 5.01-1.07 8.71-1.07 3.69-2.97 6.1-1.89 2.42-4.48 3.59-2.58 1.18-5.57 1.18-3 0-5.56-1.18-2.55-1.17-4.43-3.59-1.89-2.41-2.95-6.1-1.06-3.7-1.06-8.71 0-5.03 1.06-8.72 1.06-3.68 2.95-6.09 1.88-2.41 4.43-3.59 2.56-1.18 5.56-1.18 2.99 0 5.57 1.18 2.59 1.18 4.48 3.59 1.9 2.41 2.97 6.09 1.07 3.69 1.07 8.72m-6.75 0q0-4.16-.61-6.89t-1.63-4.35q-1.02-1.61-2.35-2.26-1.32-.65-2.75-.65-1.41 0-2.72.65t-2.32 2.26q-1.01 1.62-1.6 4.35-.6 2.73-.6 6.89t.6 6.89q.59 2.73 1.6 4.35 1.01 1.61 2.32 2.26t2.72.65q1.43 0 2.75-.65 1.33-.65 2.35-2.26 1.02-1.62 1.63-4.35t.61-6.89"/></svg>

package/templates/emdash/src/assets/placeholder/wireframe-600x400.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="600" height="400" viewBox="0 0 600 400"><rect width="100%" height="100%" fill="#DDDDDD"/><path fill="#999999" d="m155.52 171.08-17.16 21-2 2.48q1.68-.84 3.62-1.3t4.18-.46q3.28 0 6.38 1.08t5.46 3.26 3.8 5.42 1.44 7.56q0 4.04-1.48 7.58t-4.16 6.18-6.46 4.16-8.34 1.52q-4.64 0-8.32-1.48t-6.28-4.14-3.98-6.4-1.38-8.3q0-4.08 1.66-8.38t5.14-8.94l13.8-18.52q.72-.96 2.1-1.64t3.18-.68zm-14.92 50.4q2.36 0 4.34-.8t3.4-2.24 2.22-3.38.8-4.22q0-2.48-.76-4.46t-2.16-3.36-3.36-2.1-4.32-.72-4.28.8-3.28 2.22-2.12 3.36-.76 4.18q0 2.4.66 4.38t1.96 3.38 3.22 2.18 4.44.78M208.28 200q0 7.56-1.62 13.14t-4.48 9.22-6.76 5.42-8.42 1.78-8.38-1.78-6.7-5.42-4.44-9.22-1.6-13.14q0-7.6 1.6-13.16t4.44-9.2 6.7-5.42 8.38-1.78 8.42 1.78 6.76 5.42 4.48 9.2 1.62 13.16m-10.2 0q0-6.28-.92-10.4t-2.46-6.56-3.54-3.42-4.16-.98q-2.12 0-4.1.98t-3.5 3.42-2.42 6.56-.9 10.4.9 10.4 2.42 6.56 3.5 3.42 4.1.98q2.16 0 4.16-.98t3.54-3.42 2.46-6.56.92-10.4m56.6 0q0 7.56-1.62 13.14t-4.48 9.22-6.76 5.42-8.42 1.78-8.38-1.78-6.7-5.42-4.44-9.22-1.6-13.14q0-7.6 1.6-13.16t4.44-9.2 6.7-5.42 8.38-1.78 8.42 1.78 6.76 5.42 4.48 9.2 1.62 13.16m-10.2 0q0-6.28-.92-10.4t-2.46-6.56-3.54-3.42-4.16-.98q-2.12 0-4.1.98t-3.5 3.42-2.42 6.56-.9 10.4.9 10.4 2.42 6.56 3.5 3.42 4.1.98q2.16 0 4.16-.98t3.54-3.42 2.46-6.56.92-10.4m73.72 15.68-5.24 5.16-13.56-13.56-13.68 13.64-5.24-5.16 13.68-13.72L281.12 189l5.2-5.2 13.04 13.04 12.96-12.96 5.28 5.2-13 13zm34.64-8.56h17.6V188.2q0-2.68.36-5.92zm26.2 0h7.28v5.72q0 .8-.52 1.38t-1.48.58h-5.28v14.12h-8.6V214.8h-24.4q-1 0-1.76-.62t-.96-1.54l-1.04-5 27.4-36.6h9.36zm53.72-7.12q0 7.56-1.62 13.14t-4.48 9.22-6.76 5.42-8.42 1.78-8.38-1.78-6.7-5.42-4.44-9.22-1.6-13.14q0-7.6 1.6-13.16t4.44-9.2 6.7-5.42 8.38-1.78 8.42 1.78 6.76 5.42 4.48 9.2 1.62 13.16m-10.2 0q0-6.28-.92-10.4t-2.46-6.56-3.54-3.42-4.16-.98q-2.12 0-4.1.98t-3.5 3.42-2.42 6.56-.9 10.4.9 10.4 2.42 6.56 3.5 3.42 4.1.98q2.16 0 4.16-.98t3.54-3.42 2.46-6.56.92-10.4m56.6 0q0 7.56-1.62 13.14t-4.48 9.22-6.76 5.42-8.42 1.78-8.38-1.78-6.7-5.42-4.44-9.22-1.6-13.14q0-7.6 1.6-13.16t4.44-9.2 6.7-5.42 8.38-1.78 8.42 1.78 6.76 5.42 4.48 9.2 1.62 13.16m-10.2 0q0-6.28-.92-10.4t-2.46-6.56-3.54-3.42-4.16-.98q-2.12 0-4.1.98t-3.5 3.42-2.42 6.56-.9 10.4.9 10.4 2.42 6.56 3.5 3.42 4.1.98q2.16 0 4.16-.98t3.54-3.42 2.46-6.56.92-10.4"/></svg>

package/templates/static/.env

@@ -0,0 +1 @@
+CLOUDFLARE_API_TOKEN=your_cloudflare_api_token

package/templates/static/.github/workflows/ci.yml

@@ -0,0 +1,12 @@
+# Runs on every PR: typecheck + design-lint + build. deploy-dev.yml /
+# deploy-prod.yml call the same reusable `site-ci.yml` themselves before they
+# deploy, so this is what gives a PR the identical signal before it's even
+# merged to `dev` — a broken build never reaches the dev worker.
+name: CI
+
+on:
+  pull_request:
+
+jobs:
+  ci:
+    uses: getvitops/design-system/.github/workflows/site-ci.yml@v1

package/templates/static/.github/workflows/deploy-dev.yml

@@ -0,0 +1,33 @@
+# Deploys the `dev` branch to the isolated dev worker (<name>-dev, and
+# dev.<domain> if a custom domain is configured in wrangler.jsonc).
+# `dev` is the integration branch — every push here refreshes the review site.
+# Promote to production with the "Promote dev → main" workflow (promote.yml).
+#
+# Deploys via the vitops toolchain's reusable static-site deploy workflow — see
+# https://github.com/getvitops/design-system/blob/main/.github/workflows/site-deploy-static.yml
+# Pinned to @v1 so a fix there reaches this repo without a manual re-paste;
+# bump the tag deliberately if you want to pick up a change.
+#
+# Required repo secrets:
+#   CLOUDFLARE_API_TOKEN   — token with Workers edit on this account
+#   CLOUDFLARE_ACCOUNT_ID  — the Cloudflare account id
+name: Deploy dev
+
+on:
+  push:
+    branches: [dev]
+
+concurrency:
+  group: deploy-dev
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    uses: getvitops/design-system/.github/workflows/site-deploy-static.yml@v1
+    with:
+      environment: dev
+      worker-name-suffix: -dev
+      route-prefix: dev.
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

package/templates/static/.github/workflows/deploy-prod.yml

@@ -0,0 +1,29 @@
+# Deploys `main` to production.
+# `main` should be branch-protected — it then only advances via the Promote
+# workflow (promote.yml), so a push here always represents promoted code. The
+# `production` GitHub Environment (set up by `scripts/init-github.mjs`) has
+# required reviewers restricted to admins, so this PAUSES for approval before
+# deploying.
+#
+# Deploys via the vitops toolchain's reusable static-site deploy workflow — see
+# https://github.com/getvitops/design-system/blob/main/.github/workflows/site-deploy-static.yml
+#
+# Required repo secrets: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID
+name: Deploy prod
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: deploy-prod
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    uses: getvitops/design-system/.github/workflows/site-deploy-static.yml@v1
+    with:
+      environment: production
+    secrets:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

package/templates/static/.github/workflows/promote.yml

@@ -0,0 +1,16 @@
+# Promote dev → main. Run manually after reviewing the dev site.
+# Opens a PR from dev into the protected `main` branch and enables auto-merge;
+# the merge triggers Deploy prod.
+#
+# Deploys via the vitops toolchain's reusable promote workflow — see
+# https://github.com/getvitops/design-system/blob/main/.github/workflows/site-promote.yml
+# for the branch-protection / PROMOTE_TOKEN options.
+name: Promote dev → main
+
+on:
+  workflow_dispatch:
+
+jobs:
+  promote:
+    uses: getvitops/design-system/.github/workflows/site-promote.yml@v1
+    secrets: inherit

package/templates/static/.nvmrc

@@ -0,0 +1 @@
+24